Add a File Upload field from the Gravity Forms Advanced Fields panel, restrict it to the extensions you actually need, set a per-file size limit, and enable multi-file mode only when the workflow requires several files or a drag-and-drop interface. Then decide who may download the files: Gravity Forms obscures upload URLs, but the URLs are not access-controlled by default.
Those settings cover the basic field. A reliable production workflow also needs server limits, storage, notifications, retention, and failure handling to agree with the form.
Configure the File Upload field
Open the form editor, add File Upload from Advanced Fields, and configure the three upload-specific settings.
Allowed file extensions
Enter a comma-separated list without dots, such as pdf, docx or jpg, jpeg, png. Choose the smallest set that matches the form’s job.
If the setting is blank, Gravity Forms does not simply accept every file. Its current documentation says the upload is checked against a global disallowed-extension list and, unless a developer has disabled the check, WordPress verifies that the file’s detected type matches its extension. Adding an allowlist is still the better form-level policy because it rejects irrelevant types and tells the visitor what the form expects.
| Workflow | Example allowlist | Question to settle first |
|---|---|---|
| Resume or application | pdf, docx |
Will reviewers accept editable documents, or should PDF be required? |
| Photo evidence | jpg, jpeg, png |
Must phone formats such as HEIC be converted before upload? |
| Spreadsheet import | csv, xlsx |
Will the receiving process validate file contents before import? |
| Signed document | pdf |
Does the workflow need an authenticated portal instead of an emailed file? |
WordPress MIME rules still apply. Adding an extension to the field does not guarantee that WordPress or the server will accept a file whose contents do not match the extension.
Maximum file size
The field’s Maximum File Size is measured per file. If it is blank, Gravity Forms uses the server’s maximum upload size. Set an explicit limit that reflects the actual job so visitors see the limit before waiting on an upload the site will reject.
The effective limit cannot exceed the server configuration. PHP’s upload_max_filesize limits an individual uploaded file, while post_max_size limits the complete request and must be larger than upload_max_filesize. max_file_uploads limits how many files PHP accepts in one request. Hosting proxies, web servers, security services, and application platforms can impose lower limits too.
Check Forms → System Status and the host’s PHP settings before raising a field limit. Do not publish a 100 MB field limit when the request is blocked at 32 MB upstream.
Single-file or multi-file mode
Single-file mode uses the browser’s standard file input and sends the file with the form submission. Multi-file mode displays a drag-and-drop zone and uploads selected files with AJAX. Gravity Forms recommends multi-file mode as one way to improve final submission performance because the file begins uploading when it is selected.
You can enable multi-file mode and set Maximum Number of Files to 1 when you want the upload-progress interface for a one-file workflow. Test the experience with keyboard input and a phone; drag and drop cannot be the only understandable instruction.
For File Upload fields created before Gravity Forms 2.10.0, the single-versus-multiple setting can become locked after the field has been used in an entry. This limitation does not apply to every new field. Do not delete production entries merely to unlock it; add a replacement field and plan how historical entry data will be handled.
Where Gravity Forms stores uploaded files
By default, Gravity Forms stores files beneath the WordPress uploads directory in a form-specific folder similar to:
/wp-content/uploads/gravity_forms/82-unique-hash/The unique folder name is generated with a salted HMAC-MD5 algorithm to make guessing difficult. Gravity Forms places empty index.html files in subfolders to discourage directory listings. On servers that honor it, a generated .htaccess file in the Gravity Forms upload root prevents PHP from being parsed in the subfolders.
These measures do not encrypt the file and do not turn its URL into an authenticated permission check. Gravity Forms states that anyone with the correct download URL can access the file by default.
What happens when an entry is removed
- Moving an entry to Trash keeps its uploaded files.
- Marking an entry as spam keeps its uploaded files.
- Deleting an entry permanently deletes its uploaded files.
Build retention around permanent deletion, backups, external copies, and legal requirements—not the assumption that trashing an entry removes the file everywhere.
Secure Gravity Forms file downloads
Use the uploaded file’s sensitivity to choose an access model.
Public or low-sensitivity files
An obscured link may be sufficient for a low-risk workflow if the URL is sent only to the intended administrative recipient and the retention period is short. “Hard to guess” is not the same as access control, so document that choice.
Files for logged-in users
Gravity Forms provides the gform_require_login_pre_download filter to require login before a secure download URL is served. Requiring login alone does not prove that this user owns this entry, so use a capability or ownership check where users should see only their own files.
Files requiring entry-level authorization
Use gform_permission_granted_pre_download for custom permission logic, such as confirming that the current user created the entry or has a staff capability. Implement this in a small custom plugin and test allowed, denied, logged-out, and expired-session cases.
Sensitive or regulated documents
Do not rely on an obscured web URL or broad “encryption” language. Decide where encryption occurs, who controls keys, whether backups contain the file, how access is audited, and when every copy is deleted. For highly sensitive uploads, an authenticated document portal or purpose-built storage system may be a better boundary than the normal WordPress uploads directory.
Gravity Forms recommends requiring login for upload forms when the workflow permits it and restricting extensions to the narrowest practical list. Do not disable MIME/extension checks or the generated upload protections merely to make a failed test pass.
Display or send uploaded files
View a file in the entry
Open Forms → Entries, select the form, and open the entry. The File Upload field contains the stored file link or links. This is the simplest administrative access path.
Add a link to a notification or confirmation
Insert the File Upload field’s merge tag using the merge-tag picker. A field merge tag follows this pattern:
{Uploaded Document:5}Add the :download modifier when the link should force a download:
{Uploaded Document:5:download}Do not put confidential upload merge tags in a confirmation page or a notification sent to an untrusted recipient. Anyone who receives the resolved URL may be able to use it unless additional download authorization is configured.
Display an uploaded image
A standard File Upload field links a file to a Gravity Forms entry; it does not automatically create a WordPress Media Library attachment. For an administrative email, a file-field merge tag is usually enough. For a public gallery, profile image, or user-submitted post, define a moderated publishing workflow and use the Post Image field or Advanced Post Creation media handling where appropriate.
Do not render arbitrary uploads directly into a public page without validating the type, authorizing the submitter, escaping output, and deciding who approves publication.
Attach files to email notifications
In the Gravity Forms notification settings, enable Attachments to attach files uploaded through File Upload fields. A link is often safer and more deliverable than an attachment: mail systems have message-size limits, attachments create additional copies outside WordPress, and sensitive files can remain in multiple inboxes and archives.
Send Gravity Forms uploads to Dropbox
The official Dropbox Add-On supports two distinct workflows.
Move normal File Upload fields after submission
Connect Dropbox under Forms → Settings → Dropbox, then create a form-specific Dropbox feed. The file is initially uploaded to the WordPress server. The feed transfers it to Dropbox asynchronously; after Dropbox confirms the transfer, Gravity Forms updates the entry to the Dropbox URL and deletes the local file.
This is not an instant, server-free upload. Gravity Forms warns that the process can take several minutes, and a failed background task can leave the local file in place. Monitor failed feeds and do not promise immediate deletion.
Let a user select a file from their own Dropbox
When the add-on uses a custom Dropbox app, the Dropbox Upload field lets a visitor select a file from their Dropbox account. Dropbox copies it to the destination account without first storing the file on the WordPress server. This is a separate field and connection model from moving a normal File Upload field after submission.
Google Drive, S3, FTP, and generic media offload
Gravity Forms does not officially support generic plugins that offload the WordPress uploads directory; its documentation warns that file uploads may not work as expected. For another destination, use a supported integration, an automation whose failure state you monitor, or a custom transfer built around a documented post-submission hook. Confirm when the local file is deleted and what happens when transfer fails.
Troubleshoot common upload failures
“File type is not permitted”
- Check the field’s Allowed file extensions.
- Confirm that WordPress permits the file’s MIME type.
- Confirm that the extension matches the file’s actual contents.
- Test with a newly created known-good file rather than repeatedly renaming the same rejected file.
Do not disable validation as the first fix. Determine which layer rejected the file and whether the business workflow should accept that type.
“File exceeds the maximum allowed size”
Compare the field limit, PHP upload_max_filesize, PHP post_max_size, the total number and size of files, and any host, proxy, CDN, or firewall limit. The smallest active limit wins. After a host change, retest both one-file and maximum-file-count submissions.
“Temporary file could not be moved” or “Upload folder is not writable”
Check write permission and ownership for wp-content/uploads, wp-content/uploads/gravity_forms, and the relevant subfolder. Gravity Forms notes that 755 or 775 is common, but the correct permission depends on the hosting environment. Do not apply a broad recursive permission change blindly; ask the host to confirm which server user must write to the directory.
Also review PHP’s temporary upload directory and Gravity Forms logging. Search the log for GF_Field_FileUpload messages that identify the failed move or validation.
The multi-file setting is disabled
First confirm the field’s creation history and Gravity Forms version. The locked setting is documented for fields added before version 2.10.0 after an entry used the field. A replacement field is safer than deleting all historical entries. Keep the old field administrative-only if staff still need its entry data.
The upload is missing from the email
Confirm that the notification’s Attachments setting is enabled and that the notification event runs after the final file location is available. Then compare total attachment size with the sending service and recipient limits. Prefer a protected download link when attachments are large or sensitive.
A Dropbox transfer remains local
The feed is asynchronous. Check the entry notes, Gravity Forms/Dropbox logs, WordPress scheduled actions or cron health, and Dropbox authorization. Do not delete the local file until the external copy is confirmed and the entry points to the intended destination.
Uploads fail mostly on phones
Test on cellular data with the same file types and sizes users submit. Check whether phone camera images use an unlisted format, whether the page explains the limit before selection, and whether a long upload can survive connection changes. Multi-file mode with one allowed file can provide earlier progress feedback, but it cannot make a slow connection or upstream size limit disappear.
Use a video-response field for recordings
A screen recording or camera response is often better treated as a recording workflow than a raw file upload. Video files are large, formats vary, and a WordPress upload does not provide a recording interface or playback platform.
Odd Jar makes Loom for Gravity Forms, which lets a respondent record or attach a Loom video from a Gravity Forms field and stores the Loom URL with the entry. The respondent does not need a Loom account. This is a commercial alternative for support recordings, bug reports, testimonials, or onboarding videos; it is not a replacement for ordinary PDF, image, or spreadsheet uploads.
Test the complete upload lifecycle
Before launch, test a valid file, a disallowed type, a file just over the limit, the maximum file count, a mobile upload, a notification, a protected download, and permanent entry deletion. If files move to external storage, test a successful transfer and a deliberately interrupted background process.
The field is ready only when the upload, entry, notification, authorization, retention, and failure path all behave as documented. That is the difference between a file picker that works in the editor and an upload workflow that can be operated safely.
